A Survey of Computational Location Privacy

1. A Survey of Computational Location Privacy John KrummMicrosoft ResearchRedmond, WA USA

2. Subtleties of Location Privacy “… a special type of information privacy which concerns the claim of individuals to determine for themselves when, how, and to what extent location information about them is communicated to others.” Duckham, M. and L. Kulik, Location privacy and location-aware computing, in Dynamic & Mobile GIS: Investigating Change in Space and Time, J. Drummond, et al., Editors. 2006, CRC Press: Boca Raton, FL USA. p. 34-51. When: For D-Day attack, troop location privacy not important 60 years later How: Alert fires to tell your family whenever you stop for pancakes “Michael Mischers Chocolates”“Weight Watchers” To what extent: Accuracy high enough to distinguish?

3. Computational Location Privacy Law – Privacy regulations enforced by government Policy – Trust-based, often from institutions Encryption – Applies to any type of data. Computational Location Privacy – Exploits geometric nature of data with algorithms

4. Outline • Why reveal your location? • Do people care about location privacy? • Computational location privacy threats • Computational countermeasures • Quantifying location privacy • Research issues

5. Why Reveal Your Location? If you want to know your location, sometimes have to tell someone else. Loki Wi-Fi locator – send your Wi-Fi fingerprint and get back (lat,long) Quova Reverse IP – send your IP address and get back (lat,long) Exceptions Cricket – MIT POLS – Intel Research UbiSense – static sensors receive UWB to compute (x,y,z)

6. Variable Pricing Congestion Pricing Pay As You Drive (PAYD) Insurance

7. Traffic Probes http://dash.net/

8. Social Applications GeotaggedFlickr Dodgeball Geotagged Twitter MotionBased

9. Location-Based Services Tracking Local Information Navigation Games Location Alerts

10. Research MSMLS (Seattle) OpenStreetMap (London)

11. Outline • Why reveal your location? • Do people care about location privacy? • Computational location privacy threats • Computational countermeasures • Quantifying location privacy • Research issues

12. People Don’t Care about Location Privacy • 74 U. Cambridge CS students • Would accept £10 to reveal 28 days of measured locations (£20 for commercial use) (1) • 226 Microsoft employees • 14 days of GPS tracks in return for 1 in 100 chance for $200 MP3 player • 62 Microsoft employees • Only 21% insisted on not sharing GPS data outside • 11 with location-sensitive message service in Seattle • Privacy concerns fairly light (2) • 55 Finland interviews on location-aware services • “It did not occur to most of the interviewees that they could be located while using the service.” (3) (1)Danezis, G., S. Lewis, and R. Anderson. How Much is Location Privacy Worth? in Fourth Workshop on the Economics of Information Security. 2005. Harvard University. (2) Iachello, G., et al. Control, Deception, and Communication: Evaluating the Deployment of a Location-Enhanced Messaging Service. inUbiComp 2005: Ubiquitous Computing. 2005. Tokyo, Japan. (3) Kaasinen, E., User Needs for Location-Aware Mobile Services. Personal and Ubiquitous Computing, 2003. 7(1): p. 70-79.

13. Documented Privacy Leaks How Cell Phone Helped Cops Nail Key Murder Suspect – Secret “Pings” that Gave Bouncer Away New York, NY, March 15, 2006 Stalker Victims Should Check For GPSMilwaukee, WI, February 6, 2003 Real time celebrity sightings http://www.gawker.com/stalker/ A Face Is Exposed for AOL Searcher No. 4417749 New York, NY, August 9, 2006

14. Subtleties of Location Privacy • Interviews of location based services users • Less worry about location privacy in closed campus (1) • Interviews in 5 EU countries • Price for location varied depending on intended use (2) • Greeks significantly more concerned about location privacy • Study two months after wiretapping of Greek politicians (2) (2)Cvrček, D., et al., A Study on The Value of Location Privacy, in Fifth ACM Workshop on Privacy in the Electronic Society. 2006, ACM: Alexandria, Virginia, USA. p. 109-118. (1) Barkhuus, L., Privacy in Location-Based Services, Concern vs. Coolness, in Workshop on Location System Privacy and Control, Mobile HCI 2004. 2004: Glasgow, UK.

15. Outline • Why reveal your location? • Do people care about location privacy? • Computational location privacy threats • Computational countermeasures • Quantifying location privacy • Research issues

16. Computational Location Privacy Threats Not computational: browsing geocoded images Not computational: browsing GPS tracks Not computational: stalking, spying, peeping

17. Significant Locations From GPS Traces • Ashbrook & Starner, 2003 • cluster places with lost GPS signal • user gives label Common aim: find user’s significant locations, e.g. home, work • comMotion (Marmasse & Schmandt, 2000) • consistent loss of GPS signal → salient location • user gives label (e.g. “Grandma’s”) • Project Lachesis (Hariharan & Toyama, 2004) • time/space clustering • hierarchical • Kang, Welbourne, Stewart, & Borriello, 2004 • time-based clustering of GPS (lat,long)

18. Context Inference • Patterson, Liao, Fox & Kautz, 2003 • GPS traces • Infer mode of transportation (bus, foot, car) • Route prediction Location says a lot about you • Krumm, Letchner & Horvitz, 2006 • Noisy GPS matched to road driven • Constraints from speed & road connectivity • Predestination (Krumm & Horvitz, 2006) • Predict destination • Extends privacy attack into future

19. Context Inference - Wow Indoor location sensors Machine learning to infer these properties based only on time-stamped location history IJCAI 2007 Good: TEAM, ROOM OK: AGE, COFFEE, SMOKING Bad: POSITION, WORK FREQUENCY

20. Location is Quasi-Identifier Quasi-Identifier – “their values, in combination, can be linked with external information to reidentify the respondents to whom the information refers. A typical example of a single-attribute quasi-identifier is the Social Security Number, since knowing its value and having access to external sources it is possible to identify a specific individual.” Secure Data Management, VLDB workshop, 2005

21. Simulated Location Privacy Attack 1 Active BAT indoor location system • Experiment • Attach pseudonym to each person’s location history • Check • Where does person spend majority of time? • Who spends most time at any given desk? • Found correct name of all participants IEEE Pervasive Computing Magazine, Jan/March 2003

22. Simulated Location Privacy Attack 2 • Experiment • GPS histories from 65 drivers • Cluster points at stops • Homes are clusters 4 p.m. – midnight • Found plausible homes of 85% IEEE Pervasive Computing Magazine, Oct/Dec 2006

23. Simulated Location Privacy Attack 3 Pervasive 2007 MapPoint Web Service reverse geocoding Windows Live Search reverse white pages

24. Simulated Location Privacy Attack 4 • Three GPS traces with no ID or pseudonym • Successful data association from physical constraints From “multi-target tracking“ algorithms originally designed for military tracking Security in Pervasive Computing, 2005

25. Simulated Location Privacy Attack 5 • Home with three occupants • Two-state sensors • Continuity analysis on thousands of sensor readings • 85% correct data association Pervasive, 2005

26. Simulated Location Privacy Attack 6 Refinement operators for working around obfuscated location data original σ= 50 meters noise added • Example refinement sources • Must stay on connected graph of locations • Movements are goal-directed • Maximum speed constraint GIScience 2006

27. Outline • Why reveal your location? • Do people care about location privacy? • Computational location privacy threats • Computational countermeasures • Quantifying location privacy • Research issues

28. Computational Countermeasures Four ways to enhance location privacy Regulations – govt. enforced Policies – trust-based agreements Anonymity – pseudonyms and/or ambiguity Obfuscation – reduce quality of data Dynamic & Mobile GIS: Investigating Change in Space and Time, CRC Press, 2006

29. Computational Countermeasures: Pseudonyms • Pseudonimity • Replace owner name of each point with untraceable ID • One unique ID for each owner • Example • “Larry Page” → “yellow” • “Bill Gates” → “red” • Beresford & Stajano (2003) propose frequently changing pseudonym • Gruteser & Hoh (2005) showed “multi-target tracking” techniques defeat complete anonymity

30. Computational Countermeasures:k-Anonymity I’m chicken # 341, and I’m in this building (along with k-1 other chickens). I’m chicken # 341, and I visited this place in the past 21 minutes (along with k-1 other chickens). • k-anonymity introduced for location privacy by Gruteser & Grunwald, 2003 • They note that temporal ambiguity also gives k-anonymity • Pattern of service requests could break k-anonymity (Bettini, Wang, Jajodia 2005)

31. Computational Countermeasures:Mix Zones Beresford & Stajano, 2003 • New, unused pseudonym given when user is between “application zones” • “k-anonymous” when you can be confused with k-1 other people • Anonymity (i.e. k) varies with busyness of mix zone • Attack by trying to list all pseudonyms given to a person • Can use probabilistic paths to associate pseudonyms

32. Computational Countermeasures:False Reports • Mix true location report with multiple false reports • Act only on response from true report Pervasive Services, 2005 false true false • Communication overhead (addressed in paper) • Attack by finding most sensible sequence of location reports • Counter by making false sequences sensible (addressed in paper) (fun research project)

33. Computational Countermeasures:Obfuscation • Formalizes obfuscation techniques • Client & server can negotiate what needs to be revealed for successful location based service Pervasive 2005 original low accuracy low precision (from Krumm 2007)

34. Computational Countermeasures:Obfuscation Conclusion: need lots of obfuscation to counter privacy attack

35. Computational Countermeasures:Obfuscation SECURECOMM 2005 Confuse the multi-target tracker by perturbing paths so they cross

36. Outline • Why reveal your location? • Do people care about location privacy? • Computational location privacy threats • Computational countermeasures • Quantifying location privacy • Research issues

37. Quantifying Location Privacy You have a friend in this room. You have a friend on this block. quality of service (QoS) Somewhere, you have a friend. location privacy How do you measure the x axis?

38. Quantifying Location Privacy SECURECOMM 2005 Location privacy = expected error in attacker’s estimate of location • Simple to understand, easy to compute • Ignores semantics of (lat,long), e.g. vs.

39. Quantifying Location Privacy location privacy = accuracy of location data Same semantic problems as previous

40. Quantifying Location Privacy • You: I am somewhere in this circle • Server: Given this, I can narrow down the nearest gas station to three possibilities COSIT 2005 location privacy ~= size of circle

41. Quantifying Location Privacy Mobisys 2003 I’m chicken # 341, and I’m in this building (along with k-1 other chickens). location privacy = k k-anonymity

42. Quantifying Location Privacy Beresford & Stanjano, IEEE Pervasive Computing Magazine, 2003 location privacy = entropy in location estimate

43. Outline • Why reveal your location? • Do people care about location privacy? • Computational location privacy threats • Computational countermeasures • Quantifying location privacy • Research issues

44. Research Opportunities • Privacy Attitudes – In the abstract, people don’t care. But attitudes depend on many things. What are the dependencies and how strong? • Privacy Attacks – Do one to raise consciousness of problem • Inference Attacks – Find weaknesses in proposed algorithms • Hacker Challenge – Challenge people to break your scheme • False Location Reports – simulate actual motion to make it plausible. Arms race between white hats and black hats. • Location Privacy vs. QoS– Tradeoff location privacy for quality of service • Quantify Location Privacy – find a way that matches perceptions 16th USENIX Security Symposium, 2007

45. End